dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efeSHA-256 hash

Reported by 1 independent source · first reported 12 Jun 2026 by Zscaler ThreatLabz · last reported 12 Jun 2026

Last reported 4 months ago

What the reports say

1 report, newest first · the exact sentence from each

“dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe”

Zscaler ThreatLabzVendor12 Jun 2026
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion

Indicators reported together

named in the same reports

npmjs[.]helpin 1 report
scanning[.]inin 1 report
fulcio.sigstore[.]devin 1 report
e1342a80d4b5e83d…180c93a4b17din 1 report
c539766062555d47…a668975e275cin 1 report
models.litellm[.]cloudin 1 report
hxxps://api.anthropic[.]com/v1/apiin 1 report

Copy these 7 indicators · defanged

7 indicators, defanged, one per line

npmjs[.]help
scanning[.]in
fulcio.sigstore[.]dev
e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d
c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c
models.litellm[.]cloud
hxxps://api.anthropic[.]com/v1/api

Thanks — we review every report.

Report a wrong value